Social Media And Consent
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
SOCIAL MEDIA AND CONSENT
Upendra Patel, Manipal Academy of Higher Education, Bengaluru (LLM in data privacy and IT laws)
ABSTRACT
Social media has become a part of our daily lives, but it also collects and uses a huge amount of our personal information. Many times, we give consent without realizing what we are agreeing to—by clicking “I Agree,” just browsing a website, or opening a software package. This paper looks at how these types of digital consent—clickwrap, browsewrap, and shrinkwrap agreements—work, and how enforceable they are in India. It also studies major privacy laws like the GDPR, CCPA, and India’s DPDP Act, pointing out where Indian law still falls short. Beyond the legal side, it discusses the ethical concerns of data mining, such as privacy, ownership, informed consent, and transparency. The main idea is that consent should not just be a formality or a checkbox—it should be a clear, informed choice that respects people’s rights in the digital world.
INTRODUCTION
To determine what we mean by social media and consent, we must first understand the concept of consent. The simplest definition of consent is giving permission or agreeing to something free from coercion or any external pressure. In the context of social media, we can define consent as a user’s voluntary agreement to collect, share, and process personal information. When a user creates an account on a social media platform, they are presented with lengthy “Terms of Use” or “privacy polices. ” Most of us scroll through them and click I agree” without even thinking once, but these dense legal documents contain clauses that give companies several rights against our personal information. These documents are generally vague & one-sided; a layman who is going to use social media does not have time to read these clauses, nor any interest.
Companies take advantage of this mentality and exploit all the details they want. “This article explores the legal, ethical, and personal implications of digital consent in the age of social media. ” Legal validity of digital consent on social media For understanding the legal validity of digital consent on social media, we need to understand how digital consent is given on social media. Digital consent is generally given by three types of agreement i. e, click wrap agreement, browse wrap agreement, shrink wrap agreement Let us understand each type of agreement one by one 1) Click wrap agreement A click-wrap agreement is a type of digital contract where users indicate their consent to terms and conditions by clicking a button.
Which means that a clickwrap agreement is a type of digital contract, where a user must actively click on a button or check a box (eg, "I agree" or "accept") to show their consent for a website. The act of signing via an electronic signature is replaced with the act of clicking. 1 For example, in the U. S. case ProCD v. Zeidenberg2, the enforceability of shrink-wrap and click-wrap agreements was upheld, provided the terms were reasonably communicated. 2) Browse wrap agreement A website agreement (i. e, terms of use or service) whose purpose is to bind the user by browsing the website. Unlike clickwrap agreements, Browsewrap agreements don’t ask users to click or do anything to show they agree. Instead, they usually say that just by using the website, the user is automatically accepting the terms. In Specht v. Netscape Communications Corp. (U. S.
),3 the court ruled that users could not be bound by terms that were not conspicuously presented. In India, although direct jurisprudence is limited, principles under the Contract Act suggest that consent must be “free” and “informed,” which weakens the enforceability of such agreements. 3) Shrink wrap agreement Shrink wrap" refers to the plastic covering around a product that keeps it sealed and untouched until someone opens it. A shrinkwrap agreement is a type of contract used for software. The rules and conditions are packed inside the box, and by opening the package or breaking the seal, the buyer is seen as agreeing to those terms—even if they haven’t read them yet. 4 Are they enforceable? Enforcement of Click Wrap Agreements Click Wrap Agreements, where users explicitly agree to terms by clicking an “I Agree” button, are more straightforward in terms of enforceability in India.
Those pop-ups where you click “I 1 What Is a Clickwrap Agreement? , Ironclad, https://ironcladapp. com/journal/contract-management/what-is-aclickwrap-agreement/ Clickwrap agreements deliver terms & conditions, privacy polices + more online without interrupting customer experience. Legally binding.
2 ProCD, Inc. v. Zeidenberg | Case Brief for Law Students | Casebriefs,
https://www.casebriefs.com/blog/law/contracts/contracts-keyed-to-farnsworth/the-bargaining-process/procd-incv-zeidenberg/ (last visited Aug. 17, 2025).
3 Specht v. Netscape Communications Corporation | Case Brief for Law Students | Casebriefs,
https://www.casebriefs.com/blog/law/contracts/contracts-keyed-to-murphy/the-bargain-relationship/specht-vnetscape-communications-corporation/ (last visited Aug. 17, 2025). 4 admin, Shrink Wrap & Click Wrap Agreements and Their Enforceability in India, RD Law Chambers (Sept. 20, 2024), https://rdlawchambers.com/patna-high-court-holds-venue-equals-seat-in-absence-of-contraryintention/.
Agree” to continue—are usually pretty solid when it comes to legal enforceability in India. That’s because they meet the Indian Contract Act’s basic rule: people need to agree to something for it to count. Courts in India have mostly backed these agreements, as long as the terms aren’t hidden away and users actually get a fair chance to read them before clicking that button. In Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010) 3 SCC 15, the Supreme Court recognized electronic communications as forming binding contracts. Although the case did not directly involve social media, it demonstrates judicial willingness to treat digital agreements as valid, provided they meet contractual requirements.
Enforcement of Shrink Wrap Agreements Shrink Wrap Agreements, where users implicitly agree to the terms and conditions by opening a product’s packaging or installing software, have sparked debate in the Indian legal landscape. In India, this has raised questions because the law says a contract needs a clear offer and acceptance. So the big question is: does opening the box count as saying “yes”? Indian courts haven’t directly ruled on this yet. But going by basic contract rules, these agreements could be valid—if the terms are simple, fair, and clearly shown to the buyer before they buy the product. Enforcement of the browse wrap agreement Among all three agreements browse wrap agreement has the weakest enforceability study found that in 2020, browse wrap agreements only had a 14% success rate, the lowest of the three types of online agreements.
This is often because no affirmative action is required for the user to assent to the browse wrap’s terms. Comparative study Agreement Type User Action Required Enforceability Browse wrap Passive use Weak Shrink wrap Opening package Moderate Regulatory gaps in Indian law GDPR (General Data Protection Regulation) is a regulation for data privacy and data protection within the European Union, and all the major laws in the world have been framed after keeping in mind the regulations of GDPR. India’s legislation for data protection, i. e, DPDP Act,2023 (Digital Personal Data Protection Act), has been formed keeping in mind the basic principle of GDPR. Until 2023, India did not have a standalone law or framework to govern data protection. The Information Technology Act, 2000 (IT Act) and rules notified thereunder formed the basis around which the data protection framework revolved.
This included the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (Privacy Rules). The DPDP Act lays down important rules for how digital personal data should be collected, used, stored, and shared. But for it to truly take effect, the Government still needs to take a few key steps—like officially activating the sections of the Act, scrapping the old Privacy Rules, and putting out detailed rules and guidelines to help enforce it properly. It’s also worth noting that the DPDP Act only covers personal data in digital form. It doesn’t deal with non-personal or non-digital data, which means that, for now, how such data is collected and used in India remains largely unregulated.
In summary, we can say that India does have separate legislation for data privacy, but still, most of the provisions of the act remain ineffective. 6
6 Data Protection Laws in India - Data Protection Laws of the World,
https://www. dlapiperdataprotection. com/? t=law&c=IN Regulatory and ethical aspects of data mining To understand the regulatory and ethical aspects of data mining, we must first understand what data mining is. Data mining is the process, or technique, of discovering information in large sets of data, such as patterns and relationships, that you can then use to make informed decisions. This process happens with the help of computers and automated processes made possible through artificial intelligence and machine learning. Data mining typically starts with a clear goal—what you’re trying to find out—and ends with useful insights that help shape strategies or decisions. On the legal side, data mining is guided by regulations that control how data is gathered, handled, stored, shared, and used—especially when it involves personal or sensitive details.
These rules are designed to safeguard privacy, promote fairness, prevent bias, and keep things transparent. Major laws that regulate how organisations handle personal data. GDPR (General Data Protection Regulation) The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live in and outside of the European Union (EU). Approved in 2016 and put into effect in 2018, the GDPR is the toughest security and privacy law in the world. It aims to give consumers control over their data by holding companies responsible for the way they handle and treat this information. CCPA (California Consumer Privacy Act) The California Consumer Privacy Act (CCPA) is a state law that grants California residents increased control over their personal information held by businesses.
It provides consumers with rights to access, delete, and opt out of the sale of their data, and also prohibits businesses from discriminating against consumers for exercising these rights. DPDP Act (Digital personal data protection) DPDP Act is India’s first comprehensive data protection law, offering a legal framework for handling digital personal data, to safeguard individual privacy while permitting lawful data processing. The Act applies to digital personal data processed within India, whether collected digitally or digitized later, and to data processing outside India if done for offering goods or services in India. 7 Now we will be discussing the ethical aspects of data mining 1) Ownership The first principle of data ethics is that an individual has ownership over their personal information.
Just as it’s considered stealing to take an item that doesn’t belong to you, it’s unlawful and unethical to collect someone’s data without their consent. 8 2) Privacy A key ethical concern in data mining is protecting people’s privacy. Since data mining can uncover sensitive personal details, it’s important to respect each person’s right to control how their information is collected, stored, shared, and used. Even if someone gives your company permission to handle their personal data, that doesn’t mean they’re okay with it being made public. 3) Informed consent Informed consent means that individuals must be fully aware of and agree to the collection and use of their data before that data is mined or processed. In short, informed consent ensures that users freely, knowingly, and explicitly agree to data practices, rather than being tricked or misled.
4) Transparency People have the right to know how their data will be collected, stored, and used. So when you're gathering data, it's important to be open and clear about it. 7 DPDP Act, 2023 and DPDP Rules, 2025, Drishti IAS, https://www. drishtiias. com/daily-updates/daily-newsanalysis/dpdp-act-2023-and-dpdp-rules-2025
8 5 Principles of Data Ethics for Business, Business Insights Blog (Mar. 16, 2021),
https://online.hbs.edu/blog/post/data-ethics.
For example, if your company wants to use an algorithm to personalize the website based on users’ shopping habits and browsing behavior, you should clearly explain this in a policy. Let users know that cookies are being used to track their activity, that the data will be securely stored, and that it will help train an algorithm to improve their experience. Users deserve this transparency so they can make an informed choice about whether to accept or reject your site’s cookies. 9 Conclusion In an era where every click, like, and share silently shapes our digital identity, the question of consent on social media is no longer just a legal formality — it is a matter of personal dignity and autonomy.
While digital consent has gained recognition in global legal frameworks, its validity and enforceability in India remain uncertain due to fragmented laws and outdated definitions of privacy and control over personal data. We can analyse that in today's world, consent for social media is not merely a document on which we can just click I agree and start using the platform. We have to rethink before clicking on I agree button whether we should click on agree button or not, whether the information that the platform is demanding is necessary for the platform or not. The question of whether they are taking information unnecessarily should be on our minds. When we talk about clickwrap agreements, these are agreement where the user explicitly click I agree button; therefore, they are highly enforceable.
While other agreements, such as browse wrap and shrink wrap, do not give consent explicitly therefore they are enforceable only to some extent. From an ethical standpoint, data mining practices must evolve to respect the individual's right to be informed, to say no, and to understand what they are truly consenting to. Consent should not be a checkbox—it should be a conversation, a choice, and a right.
9 5 Principles of Data Ethics for Business, Business Insights Blog (Mar. 16, 2021),
https://online.hbs.edu/blog/post/data-ethics.